Hi Bob, Inc. (formerly Mosaic.tech, Inc. — acquired by HiBob February 2025)

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• IDENTITY CONFLATION RISK: Slug 'mosaic' could be confused with at least three unrelated companies sharing the name: mosaicapp.com (resource/project management tool with its own Drata trust center), mosaicsmartdata.com (data analytics), and mosaic.pe. The vendor assessed here is specifically mosaic.tech (FP&A platform), now integrated into HiBob as hibob.com/finance/. Any cert attributed to mosaicapp.com or others must NOT be applied to this vendor.
• POST-ACQUISITION INTEGRATION: HiBob acquired mosaic.tech in February 2025 for $35M. All mosaic.tech URLs (including /security, /privacy-policy) now redirect with HTTP 301 to hibob.com. Assessment therefore covers HiBob's security posture. It is unclear whether HiBob's certs have been formally rescoped to include the Mosaic Finance product specifically, or whether the Finance module runs within the same certified environment as the core Bob platform.
• HIPAA POSSIBLE OVER-CLAIM: HIPAA is listed in the AI Trust Center page alongside other standards but is absent from the dedicated security page. Pre-acquisition, mosaic.tech was explicitly described as 'not HIPAA or FedRAMP certified' by third-party sources. Whether HiBob's HIPAA posture now covers the Finance module is unverified. Graded held=false until explicit documentation (BAA availability, audit scope) is provided.
• ISO 42001 UNVERIFIED: ISO/IEC 42001 (AI Management System) is mentioned once in the AI Trust Center page in a list of 'industry best practices' but no certificate, accreditation body, audit date, or scope statement is provided anywhere on the vendor domain. Graded held=false; may be aspirational.
• SOC 1 TYPE II UNVERIFIED: Mentioned only in AI Trust Center page alongside other standards. Not listed on the main security page. No report availability statement. Cannot confirm as a standalone audit.
• HOST-CERT AMBIGUITY: HiBob security page states data is hosted in 'AWS data centers that have been certified as ISO 27001, PCI DSS Service Provider Level 1, and/or SOC 2 compliant.' PCI DSS and the infrastructure ISO/SOC certs cited are AWS's own certifications, not HiBob's. HiBob does not separately claim PCI DSS for its own services.
• NDA GATING: SOC 2 Type II report and penetration test summary both require a signed NDA to access. This is industry-standard practice but means no public independent verification is possible for the SOC 2 scope or opinion.
• AI GOVERNANCE MARKETING VS CERT: The AI Trust Center page uses certification-like language ('HiBob follows industry best practices, including ISO 27001, ISO27018, ISO42001, HIPAA, GDPR, SOC2 type 2, and SOC1 type 2') that implies all items are held certifications. In reality, only ISO 27001:2022, ISO 27018:2019, and SOC 2 Type II are explicitly confirmed on the security page. The remaining items may be frameworks followed rather than audited certifications.